Trojan.Encoder.41730

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\dosomething.ps1
%TEMP%\resbe6f.tmp
%TEMP%\luuxe5-1.dll
%HOMEPATH%\searches\indexed locations.search-ms.montelli
%HOMEPATH%\desktop\fi51.doc.montelli
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.montelli
%HOMEPATH%\desktop\google chrome.lnk.montelli
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url.montelli
%HOMEPATH%\desktop\telegram.lnk.montelli
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url.montelli
%HOMEPATH%\favorites\microsoft websites\microsoft store.url.montelli
%HOMEPATH%\favorites\msn websites\msn autos.url.montelli
%HOMEPATH%\favorites\msn websites\msn entertainment.url.montelli
%HOMEPATH%\favorites\msn websites\msn money.url.montelli
%HOMEPATH%\favorites\msn websites\msn sports.url.montelli
%HOMEPATH%\favorites\msn websites\msn.url.montelli
%HOMEPATH%\favorites\msn websites\msnbc news.url.montelli
%HOMEPATH%\favorites\windows live\get windows live.url.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\delegate_execute.exe.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\youtube.crx.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\search.crx.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\drive.crx.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\d3dcompiler_47.dll.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\docs.crx.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_watcher.dll.montelli
%HOMEPATH%\favorites\windows live\windows live spaces.url.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_elf.dll.montelli
%HOMEPATH%\favorites\windows live\windows live mail.url.montelli
%HOMEPATH%\favorites\windows live\windows live gallery.url.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_child.dll.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json.montelli
%TEMP%\cscbe4f.tmp
%HOMEPATH%\links\recentplaces.lnk.montelli
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.montelli
%HOMEPATH%\contacts\desktop.ini.montelli
%HOMEPATH%\contacts\user.contact.montelli
%HOMEPATH%\documents\desktop.ini.montelli
%HOMEPATH%\desktop\000814251_video_01.avi.montelli
%HOMEPATH%\desktop\coffee.bmp.montelli
%HOMEPATH%\downloads\desktop.ini.montelli
%HOMEPATH%\desktop\contoso.cer.montelli
%HOMEPATH%\favorites\desktop.ini.montelli
%HOMEPATH%\desktop\contosoroot_1.cer.montelli
%HOMEPATH%\links\desktop.ini.montelli
%HOMEPATH%\music\desktop.ini.montelli
%HOMEPATH%\favorites\links\desktop.ini.montelli
%HOMEPATH%\desktop\dashborder_120.bmp.montelli
%HOMEPATH%\links\desktop.lnk.montelli
%HOMEPATH%\pictures\desktop.ini.montelli
%HOMEPATH%\favorites\links\web slice gallery.url.montelli
%TEMP%\luuxe5-1.out
%TEMP%\luuxe5-1.cmdline
%TEMP%\luuxe5-1.0.cs
%HOMEPATH%\searches\everywhere.search-ms.montelli
%HOMEPATH%\desktop\desktop.ini.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.montelli
%HOMEPATH%\videos\desktop.ini.montelli
%HOMEPATH%\favorites\links for united states\usa.gov.url.montelli
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome.dll.montelli
%HOMEPATH%\favorites\links for united states\desktop.ini.montelli
%HOMEPATH%\searches\desktop.ini.montelli
%HOMEPATH%\saved games\desktop.ini.montelli
%HOMEPATH%\links\downloads.lnk.montelli
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\ffmpegsumo.dll.montelli

Удаляет следующие файлы

%TEMP%\resbe6f.tmp
%TEMP%\cscbe4f.tmp
%TEMP%\luuxe5-1.out
%TEMP%\luuxe5-1.0.cs
%TEMP%\luuxe5-1.pdb
%TEMP%\luuxe5-1.dll
%TEMP%\luuxe5-1.cmdline

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

TCP

Другие

'34.##9.100.209':443

Другое

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -File "%HOMEPATH%\dosomething.ps1"

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "%HOMEPATH%\dosomething.ps1"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\luuxe5-1.cmdline" (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBE6F.tmp" "%TEMP%\CSCBE4F.tmp" (со скрытым окном)